Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory


Published on

Dlaczego warto podnosić kwalifikacje i poznać Active Directory, krótkie wprowadzenie do AD

Published in: Technology
1 Like
  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • Do not spend too much time on each topic. Remember that this is a class on Windows Server® 2012, and not a class on AD DS.
  • Go through the list of physical and logical components. Offer brief descriptions of each.
    Physical Components
    Data store. Stores the AD DS information. This is a file on each domain controller.
    Domain controllers. Contain a copy of AD DS database.
    Global catalog servers. Host the global catalog, which is a partial, read‑only copy of all the domain naming contexts in the forest. A global catalog speeds up searches for objects that might be attached to other domain controllers in the forest.
    Read‑only domain controllers (RODCs). A special install of AD DS in a read‑only form. These are often used in branch offices where security and IT support are often less advanced than in the main corporate centers. RODCs are sometimes installed in Server Core installations and can be secured by using Windows® BitLocker Drive Encryption.
    Logical Components
    Partitions. The partitions that exist in AD DS, which are: domain partition, configuration partition, schema partition, global catalog, and application partitions.
    Schema. Defines the list of attributes that all objects in the AD DS can have.
    Domains. Logical, administrative boundary for users and computers
    Domain Trees. Collection of domain controllers that share a common root domain.
    Forests. Collections of domains that share a common AD DS.
    Sites. Collections of users, groups, and computers as defined by their physical locations. Useful when you plan administrative tasks such as replication of the AD DS.
    Organizational Units (OUs). Containers in AD DS that provide a framework for delegating administrative rights and for linking Group Policy Objects (GPOs). Emphasize that the OU structure does not necessarily match the organizational chart, but should be designed to meet the administrative requirements for each situation.
  • Establish clearly to students the difference between OUs and containers: explain that containers are not OUs. Although they can hold objects, they cannot have GPOs linked to them, so it is necessary to move the objects into OUs that need to be managed. Examples are user accounts, computer accounts, and groups.
    Remind students that usually the OU structure would not match the organizational chart, but would be designed to support the delegation of administration, and should be a framework to support the linking of GPOs. In a large organization, with for example 50,000 users and computers, it would be much more manageable to divide those objects into OUs.
    Discuss some of the criteria that might drive the OU structure design, such as geographical location, department, object type, and cost center.
  • Use this slide to illustrate the different relationships of a child domain or another tree, but emphasize that there is no administrative difference between the two options, apart from the names.
  • Reinforce the concept that the schema defines the rules and syntax of the AD DS database, and provides the blueprint for any objects that can be created in it.
    If you think that your students are having trouble understanding this concept, you could use this analogy or something similar:
    In a restaurant, there is a burger and a cheeseburger on the menu. If you order one of these, there are certain mandatory components, or attributes, and additional optional extras, as shown in the following table.

    In a similar way, the schema defines the objects that reside in the AD DS database, and defines the mandatory and optional attributes, and the syntax and the relationships between them. Notice that the attributes are defined first, and then the objects are defined based on the underlying attributes. Thus, an attribute that is optional for one object might be mandatory for another.
    Optionally, you can demonstrate the Schema Management tool to show how the objects are defined from attributes.
    You also can show the hierarchy of objects and the inherited attributes. For example, the parent object for User is Organizational Person, the parent object for Organizational Person is Person, and the parent object for Person is an object called Top.
    Point out to students that attributes are defined at each level in the hierarchy, so the User object contains all of the attributes that are defined on the User class, and all of the attributes defined farther up the objects hierarchy (Organizational Person, Person, Top).
  • This lesson describes the purpose of domain controllers and introduces the concept of the global catalog. It also describes in detail the logon process. This lesson covers the importance of DNS, particularly service resource (SRV) records, to the logon process. It also examines various operations master roles and how they contribute to the functioning of the AD DS domain.
    Why would you make a domain controller a global catalog server?
    Queries that are directed at the forest (rather than the domain) need to be directed to a global catalog server. This is because a domain controller that is not a global catalog only holds information about the objects in its own domain. As a best practice, you should configure every domain controller to be a global catalog, even in a single domain forest.
  • Emphasize to students that the database and services are stored on servers called domain controllers.
    Domain controllers—servers that perform the AD DS role—host the Active Directory database, SYSVOL, the Kerberos authentication service and other Active Directory services. For redundancy purposes, it is best to have at least two available domain controllers.
    Highlight that all domain controllers in a domain essentially are equal. Each domain controller contains a copy of the directory store, and updates can be made to the AD DS data on all domain controllers except for RODCs.
    Emphasize the importance of having multiple domain controllers in each domain. This provides load balancing, but more importantly, it also provides recoverability if a server failure occurs.
    Mention that all domain controllers engage in authentication and authorization, thus making it a redundant system with fewer fail points.
    This topic does not provide much information about best practices. If students are interested, you can go into more detail about installing domain controllers in remote sites to protect against an unavailable wide area network (WAN) connection. You can also talk about increasing the number of domain controllers to account for redundancy and performance.
  • Describe the role of the global catalog server when searching for objects across domains in a forest. Define a global catalog as a domain controller that replicates the partial attribute set for each domain in the forest. The domain controller does not need the partial attribute set for its own domain because it already has the full copy of the domain database, and only needs the changes made to other domains. That is why, in a single domain environment, making every domain controller a global catalog server adds no significant replication.
    Should a domain controller be a global catalog?
    Every domain controller should be a global catalog. (In some extreme situations, there might be a reason not to do so.) However, most large, distributed organizations are doing just that, so it also makes sense for less complex, smaller organizations.
  • Use this slide to illustrate how the logon process works.
    In the first phase, the user account is authenticated to DC1.
    In the second phase, the user account applies to the domain controller for a ticket to gain authorization to connect with the local computer.
    A centralized directory service such as AD DS provides a single identity store, authentication service, and point of management for administration.
    Emphasize the advantages of a single identity store for security and manageability. 
  • Discuss each of the operations master roles in as much depth as you feel is appropriate for the students.
    Be sure to point out that most master roles are so specific that the master could be offline for a while without causing any problems. For example, you do not need the schema master until you make changes to the schema, and you do not need the domain naming master until you add or remove a domain in the forest.
    Point out that other domain services can be slowed or disrupted if a domain controller is offline and not available. Be sure to point out to students that these roles all run on a domain controller, so the loss of a domain controller could cause serious problems.
    Domain Flexible Single Master Operations (FSMOs) are needed on a more regular basis than those in the forest root domain, particularly the primary domain controller (PDC) emulator.
    The relative ID (RID) master provides a pool of RIDs to each domain controller. If this master is not available, eventually a domain controller will attempt to create an account and will be unable to do so.
    Talk through the five PDC functions to the level of detail that is provided in the student handbook. Enforce that if the PDC emulator master is not available or is slow to respond, you are more likely to have issues in the domain.
    You can find which domain controllers are FSMO holders by typing the following at a command prompt, and then pressing Enter:
    Netdom query fsmo
  • Depending on the students’ experience with AD DS, you might have to explain in more detail the implications of no longer being able to run the dcpromo.exe tool as a GUI wizard. This tool is only used in Windows Server 2012 for an unattended installation. Mention to students that you can remotely promote a server to be a domain controller by using Server Manager running on Windows Server 2012.
    Emphasize to the students that this module is only concerned with installing domain controllers by using the GUI tools. There are other ways of installing domain controllers by using scripting tools such as Windows PowerShell® or VBScript.
    What is the reason to specify the Directory Services Restore Mode password?
    If the AD DS database must be restored from backup, the domain controller must be restarted into Directory Services Restore Mode. You then must use the Directory Services Restore Mode password to log on to the domain controller when it starts in Directory Services Restore Mode.
  • Use Server Manager to run through the initial process of installing an AD DS domain controller. Show the option to choose the local server or a remote server from the server pool. Explain that the initial pass installs the binaries for AD DS, and then you can continue to configure the AD DS installation.
  • Describe the command displayed on the slide, and refer to the answer file (answerfile.txt). Remind the students that dcpromo.exe cannot be used in GUI format in Windows Server 2012, but can still be typed at a command prompt when doing an unattended install.
  • Point out to students that because they are installing the domain controller using the IFM method, they should select the Install from media path check box. The next step is to type the path to the snapshot file in the Install from media path box.
  • Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory

    1. 1. Zarządzanie użytkownikami i komputerami w firmie - dlaczego warto znać Active Directory Konrad Sagała Exchange MVP Architekt Systemów IT w APN Promise S.A.
    2. 2. Kariera w IT
    3. 3. Kariera w IT - kompetencje  IT – Nauka całe życie  Obszary Wyboru  Zarządzanie systemami  Wsparcie użytkowników  Programowanie  Testowanie  Bazy Danych  Projektowanie stron webowych  …
    4. 4. Zarządzanie komputerami i użytkownikami w firmie – usługi katalogowe  Identyfikacja zasobów  Spójny sposób zarządzania:  Nazwami  Lokalizacjami  Prawami dostępu  Bezpieczeństwem  Usługami
    5. 5. Zarządzanie komputerami i użytkownikami w firmie - narzędzia  Usługi katalogowe  Active Directory  OpenLDAP  eDirectory  Lotus Domino  Oracle Internet Directory
    6. 6. Wprowadzenie do Active Directory Domain Services  Omówienie podstaw AD DS  Kontrolery domeny w Windows Server
    7. 7. Omówienie podstaw AD DS  Podstawy AD DS  Czym są domeny AD DS?  Czym są jednostki organizacyjne (OU)?  Czym jest las AD DS?  Czym jest schemat AD DS?
    8. 8. Podstawy AD DS Komponenty fizyczne Komponenty logiczne • Data store • Domain controllers • Global catalog server • RODC • Partitions • Schema • Domains • Domain trees • Forests • Sites • OUs AD DS składa się z komponentów logicznych i fizycznych
    9. 9. Czym są domeny AD DS? • AD DS wymaga co najmniej jednego kontrolera domeny • Wszystkie kontrolery domeny przechowują kopię bazy danych domeny, która jest na bieżąco synchronizowana • Domena jest kontekstem, w ramach którego są tworzone komputery, grupy i użytkownicy • Domena ogranicza zasięg replikacji • Zalecane narzędzie do tworzenia i konfiguracji obiektów to Administrative Center • Dowolny kontroler domeny uwierzytelnia logowanie do domeny
    10. 10. Czym są OUs? Organizational Units • Kontenery do grupowania obiektów w ramach domeny • OU tworzymy do: • Delegacji uprawnień administracyjnych • Aplikowania zasad grupowych (Group Policy)
    11. 11. Czym jest las AD DS? Tree Root Domain Forest Root Domain
    12. 12. Czym jest schemat AD DS? Schemat Active Directory definiuje atrybuty i klasy używane do opisu obiektów: • Attributes • objectSID • sAMAccountName • location • manager • department • Classes • User • Group • Computer • Site
    13. 13. Kontrolery domeny w Windows Server 2012  Czym jest Kontroler Domeny?  Czym jest Global Catalog?  Proces logowania do AD DS  Demonstracja: Rekordy SRV w DNS  Czym są FSMO?
    14. 14. Czym jest kontroler domeny? Kontrolery domeny • Serwery utrzymujące kopie bazy Active Directory (NTDS.DIT) i SYSVOL • Usługa uwierzytelniania Kerberos oraz usługa KDC • Dobre praktyki: • Dostępność: Co najmniej dwa kontrolery domenowych w domenie • Bezpieczeństwo: RODC i BitLocker
    15. 15. Czym jest Global Catalog? Domain B Domain A Configuration Schema Domain A Configuration Schema Domain B Configuration Schema Domain B Configuration Schema Global catalog: Przechowuje częściowe zestawy atrybutów dla innych domen w lesie. Pozwala wyszukiwać obiekty w całym lesie Global catalog server
    16. 16. Proces logowania do AD DS DC1 SVR1WKS1 Proces logowania: 1. Konto użytkownika jest uwierzytelnianiane na DC1 2. DC1 zwraca TGT do klienta 3. Klient używa TGT żeby uzyskać dostęp do WKS1 4. DC1 zezwala na dostęp do WKS1 5. Klient używa TGT żeby uzyskać dostęp do SVR1 6. DC1 zezwala na dostęp do SVR1
    17. 17. Czym są FSMO? W topologii multimaster, niektóre operacje muszą być wykonywane w jednym miejscu, serwery takie opisywane są w dokumentacji kilkoma nazwami: • Operations master (lub operations master roles) • Single master roles • FSMOs Role • Forest: • Domain naming master • Schema master • Domain: • RID master • Infrastructure master • PDC Emulator master
    18. 18. Instalacja kontrolera domeny  Instalacja poprzez Server Managera  Instalacja na Server Core Windows Server 2012  Uaktulanienie kontrolera ze starszej wersji systemu  Instalacja kontrolera domeny z użyciem opcji Install from Media  Klonowanie wirtualnych kontrolerów domeny
    19. 19. Instalacja poprzez Server Managera
    20. 20. Instalacja kontrolera na Server Core Używamy poleceniadcpromo /unattend:”D:answerfile.txt”. Poniżej przykładowy plik: [DCINSTALL] UserName=<Konto administracyjne w domenie, gdzie dodajemy kontroler> UserDomain=<Nazwa domeny> Password=<Hasło domenowe dla konta, którego używamy do promocji kontrolera> SiteName=<Nazwa site’u AD DS, do którego dodajemy kontroler> Site musi być utworzony wcześniej w przystawce Dssites.msc. ReplicaOrNewDomain=replica ReplicaDomainDNSName=<Pełna nazwa (FQDN) domeny, do której dodajemy dodatkowy kontroler> DatabasePath="<Ścieżka do katalogu na lokalnym dysku>" LogPath="<Ścieżka do katalogu na lokalnym dysku>" SYSVOLPath="<Ścieżka do katalogu na lokalnym dysku>" InstallDNS=yes ConfirmGC=yes SafeModeAdminPassword=<Hasło adminsitracyjne dla trybu offline> RebootOnCompletion=yes
    21. 21. Instalacja z użyciem opcji Install from Media
    22. 22. Dziękuję za uwagę